deps: bump go-sdk to v1.6.1 and drop CrossOriginProtection workaround#2564
Merged
Conversation
Bumps github.com/modelcontextprotocol/go-sdk from v1.6.0 to v1.6.1 and removes the CrossOriginProtection bypass we previously installed on the StreamableHTTP handler. As of go-sdk v1.6.0 the cross-origin check is opt-in: a nil CrossOriginProtection on StreamableHTTPOptions means no check is run. v1.6.1 also marks the field itself as deprecated (the SDK recommends wrapping the handler with middleware instead, and the field will be removed in v1.8.0). This server authenticates via bearer tokens, not cookies, so the Sec-Fetch-Site CSRF check is unnecessary and would block browser-based MCP clients. Leaving CrossOriginProtection unset preserves that behavior without depending on a deprecated API. Supersedes #2541. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Bumps the modelcontextprotocol/go-sdk dependency to v1.6.1 and removes the now-deprecated CrossOriginProtection workaround. Since v1.6.0, leaving CrossOriginProtection nil disables the check by default, which matches the desired behavior for bearer-token-authenticated browser MCP clients.
Changes:
- Drop
http.NewCrossOriginProtection()+AddInsecureBypassPattern("/")inpkg/http/handler.goand replace with explanatory comment. - Bump go-sdk to v1.6.1 in
go.mod/go.sum. - Regenerate third-party license files for the new version.
Show a summary per file
| File | Description |
|---|---|
| pkg/http/handler.go | Removes deprecated CrossOriginProtection option; relies on SDK v1.6.0+ nil-default behavior. |
| go.mod | Bumps go-sdk to v1.6.1. |
| go.sum | Updated module hashes for v1.6.1. |
| third-party-licenses.darwin.md | Regenerated license reference for v1.6.1. |
| third-party-licenses.linux.md | Regenerated license reference for v1.6.1. |
| third-party-licenses.windows.md | Regenerated license reference for v1.6.1. |
Copilot's findings
- Files reviewed: 5/6 changed files
- Comments generated: 0
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps
github.com/modelcontextprotocol/go-sdkfromv1.6.0tov1.6.1and removes theCrossOriginProtectionaccommodation we added in #2359 — the SDK now does the right thing by default, so the workaround is no longer needed (and uses a deprecated API).Goal: allow end users to connect via web MCP clients without us holding onto a deprecated escape hatch.
What changed in the SDK
AddInsecureBypassPattern("/")was required for browser clientsCrossOriginProtection= no check (matches our intent)StreamableHTTPOptions.CrossOriginProtectiondeprecated (removed in v1.8.0); recommended pattern is to wrap the handler with middlewarev1.6.1 also adds an
MCPGODEBUG=disablecontenttypecheck=1escape hatch. We don't need it — the SDK already usesmime.ParseMediaType, soapplication/json; charset=utf-8works (theNormalizeContentTypeworkaround was already removed in 91d6465).Diff highlights
pkg/http/handler.go: drophttp.NewCrossOriginProtection()+AddInsecureBypassPattern("/"); leaveCrossOriginProtectionunset so we don't depend on a deprecated field.go.mod/go.sum/third-party-licenses.*.md: bump go-sdk to v1.6.1 and regenerate licenses.Regression coverage
Existing tests in
pkg/http/handler_test.goalready guard the browser-client scenario and continue to pass:TestCrossOriginProtection— POSTs withSec-Fetch-Site: cross-site+Origin: https://example.com,same-origin, and noSec-Fetch-Site(native client) — all assert 200 OK.TestContentTypeHandling— verifiesapplication/json; charset=utf-8(and friends) are accepted.Plus:
script/lintclean,script/testgreen,script/licensesregenerated.Follow-up
Companion PR in
github/github-mcp-server-remotewill bump its owngo-sdkdep to v1.6.1 and pick up the newgithub-mcp-serverrelease. No code changes needed there — the remote consumespkg/httpandossmiddleware.SetCorsHeadersfrom this repo, so all accommodations live here.Supersedes #2541 (Dependabot).